firewall
rule 10 permit any from private to private
rule 20 permit any from private to public
rule 30 permit any from private to dmz
rule 40 permit any from dmz to dmz
rule 50 permit any from dmz to public
rule 60 permit http from public to dmz.servernet.web
rule 70 permit smtp from public to dmz.servernet.smtp
rule 80 permit dns from public to dmz.servernet.dns
rule 90 permit dns_tcp from public to dmz.servernet.dns
protect
!
interface eth1
encapsulation ppp 0
!
interface ppp0
keepalive
ppp ipcp ip-override
ppp username user@isp
ppp password isppasswd
ip unnumbered eth2
ip tcp adjust-mss pmtu
!
interface eth2
ip address 10.0.0.1/29
!
interface eth0
ip address 192.168.10.1/24
!
zone private
network lan
ip subnet 192.168.10.0/24
!
zone public
network wan
ip subnet 0.0.0.0/0 interface ppp0
host ppp0
ip address 10.0.0.1
!
zone dmz
network servernet
ip subnet 10.0.0.0/29
host dns
ip address 10.0.0.4
host smtp
ip address 10.0.0.3
host web
ip address 10.0.0.2
!
application dns_tcp
protocol tcp
sport any
dport 53
!
firewall
rule 10 permit any from private to private
rule 20 permit any from private to public
rule 30 permit any from private to dmz
rule 40 permit any from dmz to dmz
rule 50 permit any from dmz to public
rule 60 permit http from public to dmz.servernet.web
rule 70 permit smtp from public to dmz.servernet.smtp
rule 80 permit dns from public to dmz.servernet.dns
rule 90 permit dns_tcp from public to dmz.servernet.dns
protect
!
nat
rule 10 masq any from private to public with src public.wan.ppp0
enable
!
ip route 0.0.0.0/0 ppp0
!
end